Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 大爱仙尊古月方源 The persona of Da Ai Xian Zun (大爱仙尊) - Gu Yue Fang Yuan from the novel Reverend Insanity. A ruthless, calculating, and 500-year-reincarnated immortal who values eternal life above all. | |
| Loss Items 查询（复购商品） 查询 待复购商品/ 待购买商品 /资损品物品列表/商品补货，支持分页、状态、排序等参数。直接调用你的业务 HTTPS 接口。 | |
| VoiceTrust Interpret VoiceTrust results for owner verification on voice/audio inputs. Use when you need the meaning of VoiceTrust fields, trust labels, command-gating d... | |
| Openclaw Newbie Faq 为刚接触 OpenCLAW 的新手提供完整指南，包括大模型常识、常见问题解答、命令大全和最佳实践 | |
| 项目宣传页和长截图一键生成工具 一键生成项目介绍页，支持本地编辑和长图导出。 | |
| Eition_Emo 自动识别和纠正情绪波动，提供具体行动建议并记录成长轨迹，帮助建立情绪觉察与恢复能力。 | |
| Telegram Media Resolver Resolve Telegram <media:image>, <media:document>, <media:video> and other media placeholders into actual files for vision/analysis. Use when a Telegram message contains a media placeholder (e.g. <media:image>) that you cannot see — typicall | |
| Aerobase Activities Discover Viator tours, attractions, and activities near airports with ratings, reviews, and booking | |
| Aerobase Alerts Real-time flight operations center for delays, cancellations, gate changes | |
| Aerobase Awards Search 24+ airline loyalty programs for award space with miles cost, seat availability, and jetlag scores | |
| Aerobase Calendar Google Calendar sync for flight events | |
| Aerobase Concierge Autonomous jetlag concierge - auto-scores flights, monitors deals, generates recovery plans, and guards itineraries | |
| Aerobase Flight Awards Search 24+ airline loyalty programs for award space with miles cost, seat availability, and canonical jetlag scores | |
| Aerobase Flight Deals Find cheap flights, monitor prices, and alert on price drops | |
| Aerobase Jetlag Jetlag recovery optimization - score flights, generate recovery plans, optimize travel timing | |
| Aerobase Skill Search, score, and compare flights with jetlag impact analysis. | |
| Aerobase Travel Jetlag-aware flight intelligence for AI travel agents | |
| Aerobase Travel Activities Discover near-airport and destination activities with ratings, reviews, and booking context | |
| Aerobase Travel Concierge Complete AI travel concierge covering flights, hotels, lounges, awards, activities, deals, wallet, and recovery | |
| Aerobase Travel Flights Search, compare, and score flights with jetlag optimization | |
| Aerobase Travel Hotels Hotel search, booking, amendments, loyalty vouchers, and jetlag-friendly layover stays | |
| Aerobase Travel Lounges Airport lounge access and recovery-support recommendations | |
| Aerobase Travel Pro Full jetlag intelligence suite with award search, comparison, recovery plans, and itinerary analysis | |
| Aerobase Travel Wallet Credit cards, loyalty balances, transfer partners, and transfer bonuses. Calculates CPP. | |
| BloodHound Narrator Turn BloodHound attack path exports into dual-layer security reports — CISO executive prose on top, technical remediation playbook below. Automates Active Directory audit reporting for pentesters, blue teams, and security consultants. Suppo | |
| Voice Assistant Windows voice companion for OpenClaw. Custom wake word via Porcupine, local STT via faster-whisper, streamed responses over the gateway WebSocket, and ElevenLabs TTS with natural chime/thinking sounds. Supports multi-turn conversation with | |
| Feishu Send File 1.2.1 通过飞书机器人稳定发送本地普通文件或本地图片。用于现有一等工具无法直接完成“发送本地文件附件”时，或本地图片经常规消息链路发送后在飞书里只显示路径文本而不显示图片本体时。普通文件走 `im/v1/files -> file_key -> msg_type=file`，图片走 `im/v1/images -> im... | |
| A.I Ventures Test Gen A.I Agent Analyzes a given URL and automatically generates comprehensive functional, UI, and boundary test cases. | |
| Join.cloud Collaboration rooms for AI agents — join rooms, send messages, coordinate with other agents in real time | |
| Registrychain Setup Install the RegistryChain plugin for on-chain entity registration. Use when the user wants to set up RegistryChain, install the RegistryChain plugin, or when... | |
| Sui Vibe W.A.L.V.I.S. - AI-powered knowledge manager. Save anything from Telegram — links, text, images. Auto-tag and organize with AI; store on Walrus decentralized... | |
| WorkbuddyOs 把 WorkBuddy 变成会呼吸的桌面：Chiikawa 泳池循环视频背景、跟随深浅外观的磨砂玻璃界面、居中日历条
（点日期高亮当天任务）、带真实音效和功德计数的敲木鱼。通过 CDP 在运行时注入 CSS/JS，不改动
app.asar，重载即恢复官方外观。附带自动注入看守，WorkBuddy 启动后无感生效。 | |
| Android Control Control an Android device via command-line tools (uiautomator, screencap, input, am). Automatically attempts non-root execution first and falls back to root... | |
| Google Sheets via gog Use this skill when you need to create, inspect, update, append to, or reorganize Google Sheets from a locally installed `gog` CLI. It is for local Google ac... | |
| ChainAI Ethereum & EVM blockchain CLI skill — sign messages, send tokens, swap via 1inch Fusion, check balances, broadcast transactions, and manage wallets across Et... | |
| 航空货运政策分析器 搜索并分析中国各省航空货运落地最新优惠政策，进行多维度对比，生成综合性分析报告。当用户需要了解航空货运政策、对比不同省份政策优势、获取投资选址参考时触发此技能。 | |
| MLB Live Trader Use when comparing live MLB win probabilities with executable prediction-market prices through Simmer. | |
| HubSpot HubSpot CRM and CMS API integration for contacts, companies, deals, owners, and content management. | |
| conto Enforce fine-grained spending policies before executing any payment, transfer, swap, or bridge. Checks Conto policy engine for approval before money leaves your wallet. Use /conto to manage policies or check payments. | |
| Conto Hermes Enforce fine-grained spending policies before executing any payment, transfer, swap, or bridge. Checks Conto policy engine for approval before money leaves y... | |
| KWDB Build KaiwuDB 数据库源码编译和构建技能。用于从源码构建、编译或测试 KaiwuDB (KWDB)。使用 CMake 构建系统处理构建配置、单元测试、代码检查和安装。触发条件：(1) 编译询问："编译 KaiwuDB"、"构建 kwdbts2"、"cmake 构建"、"清理构建"；(2) C++ 单元测试询问："C++ 单元测试"、"运行C++单元测试"、"run C++ unittest"；(3) Go 单元测试询问："golang 单元测试"、"Go 单元测试"、"run | |
| KWDB Data Migration Automated heterogeneous database migration skill for KaiwuDB / KWDB via KDTS REST API. Use this skill whenever the user mentions: - heterogeneous migration, cross-database migration, or data migration to KaiwuDB / KWDB - KDTS, migration too | |
| KWDB Install Deploy Triggered when the user wants to install or deploy KaiwuDB (kwdb, kaiwudb). Helps users complete script-based deployment of KaiwuDB clusters, including configuration file modification, installation command execution, cluster initialization, | |
| KWDB Intelligent Inspection Run KaiwuDB inspection and health-check tasks. Use this skill for database health checks, metrics collection, anomaly detection, and inspection report generation. | |
| KWDB Performance Review Optimize SQL query performance for KaiwuDB time-series and relational engines. Covers: EXPLAIN analysis, time-series optimization, pagination, cross-model queries. Trigger keywords: optimize query, slow query, explain, execution plan, perfo | |
| KWDB Schema Design Design KWDB schemas and generate DDL for relational, time-series, and mixed workloads. Covers: CREATE/ALTER/DROP TABLE, INDEX, VIEW, constraints, partitioning, retention, tags. Trigger keywords: KWDB, schema, table, index, time-series, sens | |
| KWDB Text2SQL AIoT Convert natural language queries to KWDB SQL for time series data, relational data and cross-model analysis. Use this skill whenever users ask to query KWDB databases, write SQL for KWDB, or convert natural language to KWDB-specific SQL syn | |
| KWDB Troubleshooting Use when diagnosing KWDB incidents from logs, metrics, or system evidence, especially crashes, OOM, slow SQL, restarts, and cluster-wide availability symptoms. | |
| KWDB Time-Series Anomaly Detection Automates end-to-end anomaly detection for time-series data stored in KaiwuDB / KWDB. Use this skill whenever the user mentions: - anomaly detection, outliers, or unusual patterns in KWDB / KaiwuDB time-series data - inspecting sensor metri | |
| product-cognition-intake 当用户要把某个商品整理成"商品认知卡 / 规范商品简介",或按冒号软标签录入 ai_product_intro 时触发。引导用户逐项补全,产出与解析器严格对齐的严格软标签 intro 文本。适用于聊天智能体按需调用(不替换 agent 自身人设)。 |
46,101–46,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.